{"record":{"id":"089a5168bc5c18cf","repo":"owasp-amass/amass","slug":"wildcard-detected","errorCode":null,"errorMessage":"wildcard detected","messagePattern":"wildcard detected","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"engine/plugins/support/resolvers.go","lineNumber":105,"sourceCode":"\t{\"81.218.119.11\", 1},   // GreenTeamDNS Primary\n\t{\"209.88.198.133\", 1},  // GreenTeamDNS Secondary\n\t{\"37.235.1.177\", 1},    // FreeDNS\n\t{\"38.132.106.139\", 1},  // CyberGhost\n}\n\nvar trusted *pool.Pool\nvar detector *wildcards.Detector\n\nfunc PerformQuery(ctx context.Context, name string, qtype uint16) ([]dns.RR, error) {\n\tfor i := 1; i <= 10; i++ {\n\t\tmsg := utils.QueryMsg(name, qtype)\n\t\tif qtype == dns.TypePTR {\n\t\t\tmsg = utils.ReverseMsg(name)\n\t\t}\n\n\t\tif resp, err := dnsQuery(ctx, msg, trusted); err == nil && resp != nil {\n\t\t\tif wildcardDetected(ctx, resp, detector) {\n\t\t\t\treturn nil, errors.New(\"wildcard detected\")\n\t\t\t}\n\t\t\tif len(resp.Answer) > 0 {\n\t\t\t\tif rr := utils.AnswersByType(resp, qtype); len(rr) > 0 {\n\t\t\t\t\treturn rr, nil\n\t\t\t\t}\n\t\t\t}\n\t\t} else if err == ErrNameDoesNotExist || err == ErrNoRecordOfThisType {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\treturn nil, ErrFailedMaxDNSAttempts\n}\n\nfunc wildcardDetected(ctx context.Context, resp *dns.Msg, r *wildcards.Detector) bool {\n\tname := strings.ToLower(utils.RemoveLastDot(resp.Question[0].Name))\n\n\tif dom, err := publicsuffix.EffectiveTLDPlusOne(name); err == nil && dom != \"\" {\n\t\treturn r.WildcardDetected(ctx, resp, dom)","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/owasp-amass/amass/blob/79299dce87b0085db0f2f4ef3e9c52cccb49f514/engine/plugins/support/resolvers.go#L87-L123","documentation":"In PerformQuery (engine/plugins/support/resolvers.go), after a successful DNS response the result is fed to wildcardDetected; if the wildcard detector determines the answer came from a DNS wildcard (i.e. the name does not genuinely exist and the resolver synthesized the record), the function returns errors.New(\"wildcard detected\"). This protects enumeration results from wildcard-generated noise that would otherwise produce thousands of fake assets.","triggerScenarios":"Calling support.PerformQuery for a name whose response matches the wildcard fingerprint collected by the wildcard detector (e.g. the zone has a *.<domain> wildcard record and the queried subdomain never existed).","commonSituations":"Enumerating subdomains of zones configured with DNS wildcards (common with parking/CDN setups); cloud providers returning wildcard answers for any subdomain; re-testing previously flagged wildcard responses after zone reconfiguration.","solutions":["Discard the name as a wildcard artifact — do not add it as a discovered asset.","Check the parent zone for wildcard records (dig 'random123.<domain>') to confirm.","If it is a false positive, the wildcard detector baseline may be stale; refresh detection data and retry.","Handle the returned error distinctly (it is a plain error, match on message or wrap detection in your own check) before generic error handling."],"exampleFix":"// before\nrr, err := support.PerformQuery(ctx, name, dns.TypeA)\nif err != nil {\n    return err\n}\n// after\nrr, err := support.PerformQuery(ctx, name, dns.TypeA)\nif err != nil {\n    if strings.Contains(err.Error(), \"wildcard detected\") {\n        log.Info(\"wildcard artifact, skipping\", \"name\", name)\n        return nil\n    }\n    return err\n}","handlingStrategy":"validation","validationCode":"// Probe for a wildcard before enumerating\nrr, err := support.PerformQuery(ctx, fmt.Sprintf(\"%s.%s\", randomLabel(), domain), dns.TypeA)\nhasWildcard := err == nil && len(rr) > 0","typeGuard":null,"tryCatchPattern":"rr, err := support.PerformQuery(ctx, name, dns.TypeA)\nif err != nil && strings.Contains(err.Error(), \"wildcard detected\") {\n    return nil // discard wildcard artifact\n}","preventionTips":["Test each zone for wildcard records at enumeration start.","Exclude wildcard-flagged names from result assets.","Refresh wildcard baselines when a zone's DNS configuration changes.","Treat wildcard hits as informational, not hard failures."],"tags":["dns","wildcard","false-positive"],"backgroundTag":"unexpected-response-shape","analyzedSha":"79299dce87b0085db0f2f4ef3e9c52cccb49f514","analyzedAt":"2026-09-06T08:22:48.198Z","contentChangedAt":"2026-09-06T08:22:48.198Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}